Traefik 3.7

Apply these rules when configuring Traefik Proxy 3.7 entry points, routers, services, middleware, and Docker or Kubernetes providers. This scope covers the open-source proxy; separately review application authorization, third-party plugins, and features specific to Traefik Hub.

1. Supported builds and configuration authority

• Run the newest patch of a Traefik line that still receives security fixes. Let a trusted package source or line-following image tag select the patch, look up the current release, never loosen an existing constraint to make installation succeed, and audit images and dependencies in CI. Check the running binary and its Go runtime separately from application package audits.
• Treat install configuration, dynamic configuration, labels, annotations, watched files, and provider credentials as privileged inputs. Anyone who can change them may expose backends or change authentication; do not insert untrusted text into router expressions or configuration templates.
• Enable only the providers and entry points needed by the deployment. Run with a dedicated identity, minimal capabilities and filesystem permissions, and explicit network ingress and egress rules; do not expose backend listeners that bypass the proxy's checks.
• Use separate proxy instances and credentials for mutually untrusted administrators or tenants. Namespace selection and middleware references do not by themselves isolate a shared TLS store, listener, or configuration authority.
• Review migration notes for the installed line and verify the active routers and services after every